Plug the MAC address of your router into Kamkar's website, and chances are it will pull up its precise location, courtesy of Google Maps.

In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.

Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google's database anyway, allowing them to know the precise whereabouts of vulnerable visitors.

The database had no trouble locating a router in use since only late December in The Register's San Francisco bureau.

By combining the location and the unique identifier several times a day every single day, Kamkar said, it wouldn't be hard for Google to figure out where you live and work. And since Android phones track the signal strength of each Wi-Fi network they see, there's a good chance Google could also figure out the MAC address of your home and business routers.

“And if your Android phone goes onto that wireless network, now you're sending that data with your IP address, which is the same IP address you're probably using to log on to Gmail, Google or whatever.”

But the Android cache appears to contain at least one significant difference: It limits locations derived from cellphone towers to just 50 entries and Wi-Fi data to just 200. There is no evidence that the consolidated.db file stored on iPhones and iPads has any constraints.

A Google spokeswoman issued a statement that read:

All location sharing on Android is opt-in by the user. We provide users with notice and control over the collection, sharing and use of location in order to provide a better mobile experience on Android devices. Any location data that is sent back to Google location servers is anonymized and is not tied or traceable to a specific user.

We're guessing the only way to opt out is to exchange your Android device for a competing handset. We're not sure what to make of the word "anonymized," given the inclusion of a unique ID. We're guessing a determined law enforcement agent might be able to piece together enough of the information Google collects to figure out who you are.

Of course, Google isn't saying anything more publicly about these data collection policies, just as Apple isn't divulging much about the location caching of iPhone and iPad users. It doesn't give you a warm and fuzzy feeling about privacy in the age of mobile devices, does it? ®